You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Keycloak is the service provider to our customer's identity provider. When importing identity provider configuration via the OIDC discovery endpoint, Keycloak does not automatically enable the "Use PKCE" flag, despite the identity provider's well-known configuration explicitly advertising PKCE support.
The customer's Okta well-known URL returns the following PKCE configuration:
"code_challenge_methods_supported": [
"S256"
]
Based on RFC 8414, the code_challenge_methods_supported parameter indicates:
OPTIONAL. JSON array containing a list of Proof Key for Code Exchange (PKCE) [RFC7636] code challenge methods supported by this authorization server. [...] If omitted, the authorization server does not support PKCE.
Since the identity provider explicitly advertises PKCE support with the S256 method, I would expect Keycloak to automatically:
Enable the "Use PKCE" flag during import
Configure the appropriate code challenge method (S256)
Should Keycloak automatically enable PKCE configuration when code_challenge_methods_supported is present in the discovery metadata?
This seems like a logical enhancement that would reduce manual configuration steps, especially since the RFC clearly indicates that presence of this parameter signals PKCE support.
Has anyone else encountered this behavior, and is there an existing feature request or configuration option I might have missed?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Keycloak is the service provider to our customer's identity provider. When importing identity provider configuration via the OIDC discovery endpoint, Keycloak does not automatically enable the "Use PKCE" flag, despite the identity provider's well-known configuration explicitly advertising PKCE support.
The customer's Okta well-known URL returns the following PKCE configuration:
Based on RFC 8414, the
code_challenge_methods_supportedparameter indicates:Since the identity provider explicitly advertises PKCE support with the S256 method, I would expect Keycloak to automatically:
Should Keycloak automatically enable PKCE configuration when
code_challenge_methods_supportedis present in the discovery metadata?This seems like a logical enhancement that would reduce manual configuration steps, especially since the RFC clearly indicates that presence of this parameter signals PKCE support.
Has anyone else encountered this behavior, and is there an existing feature request or configuration option I might have missed?
All reactions